"Unfortunately, all data is lost and per design, there are no backups," Winzen told ZDNet in an email today. "I will bring my hosting back up once the vulnerability has been identified and fixed."

"As of now I haven't been able to do a full analysis of the log files and need to further analyze them, but based on my findings so far I believe that the hacker has only been able to gain administrative database rights. There is no indication of having had full system access and some accounts and files that were not part of the hosting setup were left untouched," Winzen told us.

"I might re-enable the service once the vulnerability has been found, but right now I first need to find it," he added.

And for the past two days, Winzen has been doing just that, looking at possible vulnerabilities that the hacker might have exploited to gain access to his server.

Currently, he identified one flaw, a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month in Russian PHP programming circles, but the flaw gained a lot of attention among the wider programming and infosec communities, on November 14, a day before the hack.

But Winzen told ZDNet that he doesn't believe this to be the hacker's actual point of entry.

"It is a vulnerability reported as a possible point of entry by a user and my setup was, in fact, vulnerable," he told us. "However I would deem it as unlikely to have been the actual point of entry as the configuration files with database access details were read-only for the appropriate users and commands run by this vulnerability shouldn't have had the necessary permissions."

Until then, Winzen promised more updates on the DH portal as his investigation continues. The German developer also told ZDNet that the hack might also be "an opportunity to improve some bad design choices of the past and start with an all new and improved setup, which I expect to be able to provide in December."

After the Anonymous hacker collective breached and took down Freedom Hosting II, another popular Dark Web hosting provider, in February 2017, Daniel's Hosting became the largest hosting provider for Dark Web services.

The service has been used to host everything from malware operations to political blogs, and the list of suspects who might have been interested in hacking DH ranges accordingly, from rival cybercrime gangs to nation-state hackers looking to track down dissidents and political activists.

The hack might have also been facilitated by the fact that the DH service's source code has always been open-sourced on GitHub and might have provided attackers with a more broad look into the service's inner guts.

Thank You

By registering you become a member of the CBS Interactive family of sites and you have read and agree to the Terms of Use, Privacy Policy and Video Services Policy. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services.
You will also receive a complimentary subscription to the ZDNet's Tech Update Today and ZDNet Announcement newsletters. You may unsubscribe from these newsletters at any time.